The "deny logon as a batch job" user right should be assigned to the correct accounts.

Parameter: (1) set of accounts

Technical Mechanism: (1) defined the SeDenyBatchLogonRight setting in by Local or Group Policy(2) Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment\Deny log on as batch job

References:

Resource Id

Reference

Old v4 CCE ID

CCE-165

Microsoft Security Guide for Windows Server 2003

Table 4.18 Deny log on as a batch job: Support_388945a0 and Guest (Legacy Client, Enterprise Client, and High Security)